Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1db7cdb3ffc3565…

MALICIOUS

PDF

39.4 KB Created: 2020-03-16 03:24:30 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f684512b5f88f34df0952a3ba6a2aca8 SHA-1: 4b43ba30f8210bd77d9e9b33475d10e6bce967d9 SHA-256: c1db7cdb3ffc35652d637531ac47cba48ea7e34d9134c2fd72fe2cd7a99b7c7a
94 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document exhibits characteristics of a link farm, with a high number of external URIs pointing to various domains. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a mass external link farm. The document body contains obfuscated content and embedded URLs, suggesting an attempt to disguise its true purpose, likely SEO manipulation or redirection to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://web5.pleasingfood.com/uploads/1/3/0/7/130775497/130775497.html#free+resume+powerpoint+template%28+cv+template%29
    • http://tutorloft.com/uploads/1/3/0/2/130272414/bofawisi_sadonitup_dorojekeko.pdf
    • http://www.thewillowscrown.com/uploads/1/3/0/7/130739098/588523.pdf
    • http://www.carsecurebox.fr/uploads/1/3/0/6/130604812/fufaretunotit_pojumazorarevum_zerelotub.pdf
    • http://deepculture.clothing/uploads/1/3/0/6/130639561/8966574.pdf
    • http://princessrings.net/uploads/1/3/0/6/130604653/019ad9c7b.pdf
    • http://reset.studio/uploads/1/3/0/5/130590323/koberozupulezakawe.pdf
    • http://mytryshyn.com/uploads/1/3/0/4/130483191/gutasogagaxaku.pdf
    • http://rmhcredshoegala.com/uploads/1/3/0/7/130775962/vabapoto-jelet-kogilodulanenam.pdf
    • http://ctshakerfurniture.com/uploads/1/3/0/5/130588590/wajoz.pdf
    • http://www.feralweaver.com/uploads/1/3/0/6/130621283/sezosiwovuribas.pdf
    • http://crystalroseco.com/uploads/1/3/0/8/130874451/97d877b1f9c786.pdf
    • http://asromascotlandacademy.com/uploads/1/3/0/7/130740440/742ebaeb13.pdf
    • http://joanadrussell.com/uploads/1/3/0/3/130323602/jobaloz.pdf
    • http://goldensita.com/uploads/1/3/0/2/130289304/darabisu_xevobivibavo_rukevewe.pdf
    • http://schoolnotesmagazine.org/uploads/1/3/0/5/130588675/faruv.pdf
    • http://kindkonnects.com/uploads/1/3/0/4/130492441/2167219.pdf
    • http://dinotikes.com/uploads/1/3/0/2/130271096/4602576.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072ed.bin
2298e36faf291bf3670caf24267a3b4669b41f1a07dbcc2bf15f23fb285fb0ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72ED 7444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.